Analysis

  • max time kernel
    113s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-09-2024 04:50

General

  • Target

    f539613bb8aa110f64481c22d073f510_JaffaCakes118.exe

  • Size

    236KB

  • MD5

    f539613bb8aa110f64481c22d073f510

  • SHA1

    c961c5aec12d17d0e6427bb2886619d604947c9a

  • SHA256

    e173a639506cfac3f65723d711ad072d18b95f2776581d43407e1ffb6bec441f

  • SHA512

    dba51c39a1d9f8cfe9d2a9b1cd9b06cb25f8bc60d3cae43105bb32cee0e7ff96960bd2438d4ee6e641a1416c05a5c67036696e195bb9f1cf17e49ebf158fc276

  • SSDEEP

    3072:sR9HSUA9Au2+coOnrvBcopuYYtZRsROxO1fcjBN27oZV3DwdOwUqx+LR3:49HdA9A1oyTBcop1jQxO98bvUUqcF

Score
10/10

Malware Config

Extracted

Family

buer

C2

https://gstatiknetiplist.cc/

https://gstatiknetiplist.com/

Signatures

  • Buer

    Buer is a new modular loader first seen in August 2019.

  • Buer Loader 7 IoCs

    Detects Buer loader in memory or disk.

  • Executes dropped EXE 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f539613bb8aa110f64481c22d073f510_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f539613bb8aa110f64481c22d073f510_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\ProgramData\ErrorResponder\responder.exe
      C:\ProgramData\ErrorResponder\responder.exe "C:\Users\Admin\AppData\Local\Temp\f539613bb8aa110f64481c22d073f510_JaffaCakes118.exe" ensgJJ
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:864
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 436
      2⤵
      • Program crash
      PID:1496
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1696 -ip 1696
    1⤵
      PID:4900

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      228.249.119.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      228.249.119.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      83.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      83.210.23.2.in-addr.arpa
      IN PTR
      Response
      83.210.23.2.in-addr.arpa
      IN PTR
      a2-23-210-83deploystaticakamaitechnologiescom
    • flag-us
      DNS
      17.160.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      17.160.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      232.168.11.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      232.168.11.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      183.59.114.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      183.59.114.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      206.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      206.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      88.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      88.210.23.2.in-addr.arpa
      IN PTR
      Response
      88.210.23.2.in-addr.arpa
      IN PTR
      a2-23-210-88deploystaticakamaitechnologiescom
    • flag-us
      DNS
      11.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      11.227.111.52.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
      90 B
      1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      228.249.119.40.in-addr.arpa
      dns
      73 B
      159 B
      1
      1

      DNS Request

      228.249.119.40.in-addr.arpa

    • 8.8.8.8:53
      83.210.23.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      83.210.23.2.in-addr.arpa

    • 8.8.8.8:53
      17.160.190.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      17.160.190.20.in-addr.arpa

    • 8.8.8.8:53
      232.168.11.51.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      232.168.11.51.in-addr.arpa

    • 8.8.8.8:53
      183.59.114.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      183.59.114.20.in-addr.arpa

    • 8.8.8.8:53
      206.23.85.13.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      206.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      240.221.184.93.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      240.221.184.93.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      148 B
      128 B
      2
      1

      DNS Request

      172.214.232.199.in-addr.arpa

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      88.210.23.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      88.210.23.2.in-addr.arpa

    • 8.8.8.8:53
      11.227.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      11.227.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\ErrorResponder\responder.exe

      Filesize

      236KB

      MD5

      f539613bb8aa110f64481c22d073f510

      SHA1

      c961c5aec12d17d0e6427bb2886619d604947c9a

      SHA256

      e173a639506cfac3f65723d711ad072d18b95f2776581d43407e1ffb6bec441f

      SHA512

      dba51c39a1d9f8cfe9d2a9b1cd9b06cb25f8bc60d3cae43105bb32cee0e7ff96960bd2438d4ee6e641a1416c05a5c67036696e195bb9f1cf17e49ebf158fc276

    • memory/1696-1-0x00000000005D0000-0x00000000006D0000-memory.dmp

      Filesize

      1024KB

    • memory/1696-2-0x00000000001C0000-0x00000000001CA000-memory.dmp

      Filesize

      40KB

    • memory/1696-3-0x0000000040000000-0x000000004000C000-memory.dmp

      Filesize

      48KB

    • memory/1696-5-0x00000000005D0000-0x00000000006D0000-memory.dmp

      Filesize

      1024KB

    • memory/1696-4-0x0000000040000000-0x0000000042824000-memory.dmp

      Filesize

      40.1MB

    • memory/1696-6-0x00000000001C0000-0x00000000001CA000-memory.dmp

      Filesize

      40KB

    • memory/1696-7-0x0000000040000000-0x000000004000C000-memory.dmp

      Filesize

      48KB

    • memory/1696-18-0x0000000040000000-0x000000004000C000-memory.dmp

      Filesize

      48KB

    • memory/1696-17-0x0000000040000000-0x0000000042824000-memory.dmp

      Filesize

      40.1MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.